Every audit program grows until its approval path becomes the bottleneck. The fix is not more people; it is a role model that matches the organization's own shape - and the discipline to let roles do their jobs without hand-rolling exceptions.
The cast of roles
A complete program needs a small, well-defined cast. The org admin builds and assigns templates - the architect role. Auditors fill audits within their assigned scope - the field role, scoped to org, region, area, or office. Office managers acknowledge audits landing in their offices - a light-touch checkpoint that confirms the local operation saw the submission. Management reviews and approves - the gate that seals the result. Platform administration lives above the org: tenants, IAM integration, and billing for the vendor. Five roles cover the life of nearly every audit.
Scopes, not just roles
The sophistication is in scope, not role count. An auditor scoped to a region sees and fills only the audits assigned within it; an office manager acknowledges only their offices. Scoping is a security boundary - the region's auditor should not be able to invoke another region's templates, and the hierarchy (org to region to area to office) should be a single, consistent rule set: one shared scoping function, applied everywhere, never hand-replicated per screen.
Approval chains as state
The approval chain is really the lifecycle: Draft, Submitted, OM Acknowledged, Under Review, Approved, with Needs Correction looping back when review finds gaps. Permission checks attach to transitions - who may submit, acknowledge, review, approve, or request corrections - so the chain is enforced by the platform's state machine, not by email etiquette. The review loop catches misread dials and blurred photos before they become permanent records; the state machine ensures no one can approve their own draft without touching the process.
The formula for scale
Three rules keep permission design from collapsing as programs grow: roles check permissions (resource:action pairs), not named job titles - so a custom role can be composed without code changes; scoping is one shared function; and templates are frozen while audits are in flight, so an org admin cannot edit the checklist under a live audit. Follow the formula, and adding the 40th site adds users, not design.
The approval chain that scales is the one nobody notices - because the right person always got the right audit at the right stage.